Autumn cyber security briefing: responding to evolving threats and new regulatory requirements

Proposed changes to the Cyber Security and Resilience Bill (CSRB), require organisations to understand their cyber risk and supply chain exposure – expanding the scope of the regulation to third parties such as managed services and data centres.

Leaders should prepare for increased supplier assurance and incident reporting requirements, including notification within 24 hours of awareness and full notification within 72 hours to the regulator and National Cyber Security Centre (NCSC) following a breach.

Other regulatory and advisory changes also put responsibilities on leaders. The latest CAF (Cyber Assessment Framework) 4.0 requires organisations to assign clear ownership of cyber security, fund improvements, improve monitoring and threat hunting, and introduce AI risk management.

An updated NCSC Cyber Governance Code of Practice reinforces the need for board oversight of cyber security. Additionally, an update in April this year to the Cyber Essentials assessment framework, which sets out the basic security baseline organisations should aim to achieve, brings cloud services into scope and makes multi-factor authentication (MFA) assessment an important part of the process.

What leaders can do now

• Assess services you provide and your dependencies on critical suppliers to understand third-party risk – who can access your systems? How quickly will they notify you of a breach? Can you obtain their data and logs? What are your critical services, and what are tolerable outages?
• Seek third-party evidence, such as assurance reports, to confirm suppliers meet appropriate standards such as Cyber Essentials and ISO 27001, and keep cyber security practices up to date
• Test resilience to discover how your organisation would operate if third-party systems such as student records, HR or payroll became unavailable, particularly during critical periods such as clearing, work with those suppliers to test recovery plans
• Include critical suppliers in incident response plans, business continuity plans, tabletop exercises and incident response exercises
• Fund solutions to the highest-risk gaps, assign clear ownership for cyber resilience, and regularly review progress
• Equip your staff to recognise threats such as phishing and create a culture where they feel safe to report concerns and potential incidents early, without fear of blame
• Set out clear arrangements for who can declare an incident, who commands the response, how emergency funding is authorised, how critical services are maintained and how a restored service is declared clean and safe

Protection through Jisc and Janet

We support education, research and public sector organisations to strengthen their cyber security posture and meet their compliance requirements.

Every Janet-connected organisation benefits from built-in foundation security protections including distributed denial of service (DDoS) mitigation to protect against attacks that flood systems with malicious traffic, Janet Network resolver, which blocks access to known dangerous or compromised domains, and incident response from our computer security incident response team (CSIRT).

Members and customers also benefit from Jisc training and resources and our 3,000-strong cyber community, which shares threat intelligence and good practice to help the sector defend as one.

Organisations that require more protection can upgrade to our security operations centre (SOC) for 24/7 monitoring, threat detection and response support.

Next steps

Our annual security conference takes place 24–25 November at Manchester Central and online. Book your security conference ticket now.

A ready for a cyber attack practical workshop for senior leaders is taking place on 29 October. The workshop is free and spaces remain available.